Backup Recovery Points Should Be Encrypted Rule
This rule specifies that backup recovery points must be encrypted to ensure data security.
| Rule | Backup recovery points should be encrypted |
| Framework | CISA-cyber-essentials |
| Severity | ✔ Low |
Rule Description
Backup recovery points should be encrypted for CISA Cyber Essentials. Encrypting the backup recovery points adds an extra layer of security to the data stored in these recovery points, ensuring the confidentiality of sensitive information. This rule helps organizations comply with the CISA Cyber Essentials guidelines, which aim to enhance cybersecurity practices and protect critical infrastructure.
Troubleshooting Steps
If encryption for backup recovery points is not in place, follow these troubleshooting steps:
- 1.
Verify Backup Configuration: Ensure that the backup solution being used supports encryption for recovery points. Consult the backup solution's documentation or contact their support for guidance on enabling encryption.
- 2.
Update Backup Solution: If the backup solution does not support encryption, consider switching to a different backup solution that offers encryption capabilities. Evaluate and select a new backup solution that aligns with your organization's requirements and supports backup encryption.
- 3.
Enable Encryption: Once you have a backup solution that supports encryption, enable the encryption feature according to the instructions provided by the backup solution provider. This may involve configuring encryption settings within the backup software or utilizing existing encryption features of the underlying storage system.
- 4.
Test Backup and Recovery: After enabling encryption for backup recovery points, perform a test backup and recovery to ensure that the encryption is functioning properly. Verify that the recovered data is accessible and decrypted correctly.
- 5.
Document Encryption Process: Document the steps taken to enable encryption for backup recovery points, including the configuration settings and any relevant encryption keys. This documentation will be helpful for reference and future audits.
Necessary Codes
In some cases, enabling encryption for backup recovery points may require executing specific commands or codes within the backup software or underlying infrastructure. Below are example codes for common backup solutions:
Example 1: Veeam Backup & Replication
To enable encryption for Veeam Backup & Replication recovery points, follow these steps:
- 1.Open the Veeam Backup & Replication console.
- 2.Go to the "Backup Infrastructure" view.
- 3.Right-click on "Backup Repositories" and select "Add Backup Repository" if needed.
- 4.Select the desired backup repository and click "Edit".
- 5.In the "General" tab, enable the "Enable backup repository encryption" option.
- 6.Choose an encryption method (e.g., AES-256).
- 7.Specify the encryption password or key and confirm it.
- 8.Click "OK" to save the settings.
- 9.Perform a test backup and recovery to validate the encryption.
Example 2: Backup Exec
To enable encryption for Backup Exec recovery points, follow these steps:
- 1.Open the Backup Exec Management Console.
- 2.Navigate to the "Configuration and Settings" tab.
- 3.Expand the "Backup Exec Settings" option.
- 4.Click on "Encryption".
- 5.Check the "Encrypt backup sets using password" checkbox.
- 6.Specify the encryption password and confirm it.
- 7.Choose an encryption method (e.g., AES-256).
- 8.Click "OK" to save the settings.
- 9.Perform a test backup and recovery to validate the encryption.
Note: The above examples are provided for illustration purposes only. Refer to your specific backup solution's documentation for accurate and up-to-date instructions.
Remediation Steps
Follow these step-by-step guide to remediate the lack of encryption for backup recovery points:
- 1.
Identify the backup solution being used in your organization.
- 2.
Determine if the current backup solution supports encryption for recovery points. If it does not, consider switching to a backup solution that offers encryption capabilities.
- 3.
Perform a risk assessment and evaluate various backup solutions to find the one that aligns with your organization's requirements and supports encryption for recovery points.
- 4.
If switching to a new backup solution, follow the vendor's instructions to install and configure the backup software. Ensure that encryption options are enabled during the setup process.
- 5.
Enable encryption for backup recovery points according to the instructions provided by the backup solution provider. This may involve configuring encryption settings within the backup software or utilizing encryption features of the underlying storage system.
- 6.
Test the backup and recovery process to verify that the encryption is functioning correctly. Ensure that the recovered data is accessible and decrypted properly.
- 7.
Document the encryption process, including the specific steps taken and any relevant encryption keys or passwords. This documentation will serve as a reference for future maintenance and auditing purposes.
By following these remediation steps, organizations can ensure the encryption of backup recovery points, enhancing the security of their data and aligning with the CISA Cyber Essentials guidelines.